Refactoring nethcfg role. Now each functionality is splitted in a file. Translated task names, so it is easier to follow up activities.

This commit is contained in:
Emiliano Vavassori 2016-03-14 02:00:12 +01:00
parent 8b0959a0cf
commit 7312721165
18 changed files with 481 additions and 438 deletions

View File

@ -0,0 +1,80 @@
---
# Base configurations to be implemented anyways.
# Trusted networks: LAN
- name: Check for LAN to be added as Trusted Network
shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description
register: check_trusted
changed_when: '"Description=Local LAN" not in check_trusted.stdout'
ignore_errors: yes
tags: trustednet
- name: Configuring trusted networks
shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }}
when: check_trusted|changed
tags: trustednet
- name: Activating trusted network
shell: /sbin/e-smith/signal-event trusted-networks-modify
when: check_trusted|changed
tags: trustednet
# Hostname and domainname
- name: Configuring hostname
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
register: chg_hostname
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
tags: hostname
- name: Configuring domain name
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
register: chg_domainname
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
tags: domainname
- name: Activating hostname/domainname changes
shell: /sbin/e-smith/signal-event hostname-modify
when: chg_hostname|changed or chg_domainname|changed
tags:
- hostname
- domainname
# Password policy
- name: Check for password policy
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
register: chk_passstr
changed_when: "'Users=none' not in chk_passstr.stdout"
ignore_errors: true
tags: password-policy
- name: Configuring password policy
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
when: chk_passstr|changed
tags: password-policy
- name: Activating password policy
shell: /sbin/e-smith/signal-event password-policy-update
when: chk_passstr|changed
tags: password-policy
# Base certificate
- name: Checking CA configuration
shell: /sbin/e-smith/db configuration printprop pki CommonName
ignore_errors: true
register: chk_crt
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
tags: regen-ca
- name: Configuring CA
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
tags: regen-ca
when: chk_crt|changed or force_regen_ca|bool
- name: Activating CA and regenerate
shell: /sbin/e-smith/signal-event certificate-update
when: chk_crt|changed or force_regen_ca|bool
tags: regen-ca

View File

@ -0,0 +1,45 @@
---
# Installing and configuring DHCP and DNS
- name: Installing DHCP and DNS related NethServer packages.
yum:
name: nethserver-dnsmasq
state: present
# DHCP
- name: Checking DHCP configuration
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
ignore_errors: true
register: chk_dhcp
- name: Configuring DHCP
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
when: chk_dhcp|failed
- name: Activating DHCP
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dhcp|failed
# DNS
- name: Checking DNS configuration
shell: /sbin/e-smith/db configuration printprop dns NameServers
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout"
ignore_errors: yes
- name: Configuring DNS
shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}"
when: chk_dns|changed
- name: Activating DNS
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dns|changed
# Avahi
- name: Installing avahi-daemon
yum:
name: nethserver-avahi
state: present

View File

@ -0,0 +1,21 @@
---
# Organization configuration
- name: Installing required packages
yum:
pkg: nethserver-directory
state: present
- name: Check organization configuration
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
register: check_org
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
ignore_errors: yes
- name: Configuring organization
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
when: check_org|changed
- name: Activating organization configuration
shell: /sbin/e-smith/signal-event organization-save
when: check_org|changed

View File

@ -1,49 +1,47 @@
---
- name: Verifico la presenza del gruppo Domain Users
# Domain groups
# Domain Users
- name: domusers - Checking for group
shell: /sbin/e-smith/db accounts show domusers
register: check_domusers
become: yes
ignore_errors: true
- name: Creazione gruppo Domain Users
- name: domusers - Creating new group
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
become: yes
when: check_domusers|failed
- name: Configurazione nuovo gruppo Domain Users
- name: domusers - Activating group
shell: /sbin/e-smith/signal-event group-create domusers
become: yes
when: check_domusers|failed
- name: Verifico la presenza del gruppo Domain Operators
# Domain Operators
- name: domopers - Checking for group
shell: /sbin/e-smith/db accounts show domopers
register: check_domopers
become: yes
ignore_errors: true
- name: Creazione gruppo Domain Operators
- name: domopers - Creating new group
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
become: yes
when: check_domopers|failed
- name: Configurazione nuovo gruppo Domain Operators
- name: domopers - Activating group
shell: /sbin/e-smith/signal-event group-create domopers
become: yes
when: check_domopers|failed
- name: Verifico la presenza del gruppo Docenti
# Docenti
- name: docenti - Checking for group
shell: /sbin/e-smith/db accounts show docenti
register: check_docenti
become: yes
ignore_errors: true
- name: Creazione gruppo Docenti
- name: docenti - Creating new group
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
become: yes
when: check_docenti|failed
- name: Configurazione nuovo gruppo Docenti
- name: docenti - Activating group
shell: /sbin/e-smith/signal-event group-create docenti
become: yes
when: check_docenti|failed

View File

@ -1,19 +1,58 @@
---
# Configurazione principale di NethServer.
# Configuring NethServer as requested
# Installo pacchetti addizionali
- include: neth_pkgs.yml
# Network interfaces
- include: network.yml
when: development|bool
become: yes
tags:
- nethpkg
- network
- include: reconfig_nic.yml
# Configuring base parameters
- include: base.yml
become: yes
tags:
- nethnic
- base
- include: reconfig_srv.yml
- include: ntp.yml
become: yes
tags:
- nethcfg
- ntp
# Directory and organization
- include: directory.yml
become: yes
tags:
- directory
# DHCP and DNS
- include: dhcpdns.yml
become: yes
tags:
- dhcpdns
# Other small services
- include: otherservices.yml
become: yes
tags:
- otherservices
# Proxy and web filter
- include: proxy.yml
become: yes
tags:
- proxy
- webfilter
# SAMBA and ibays
- include: samba.yml
become: yes
tags:
- samba
- ibay
# Domain groups
- include: domain_groups.yml
become: yes
tags:
- domaingroups

View File

@ -1,6 +0,0 @@
---
- name: Installazione pacchetti neth
yum: name="{{ item }}" state=present
become: yes
with_items: '{{ neth_pkgs }}'

View File

@ -0,0 +1,11 @@
---
# Reconfiguring network interfaces
- name: Configuring external NIC
shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp
- name: Configuring internal NIC
shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }}
- name: Activating changes to NICs
shell: /sbin/e-smith/signal-event interface-update

View File

@ -0,0 +1,24 @@
---
# Network time protocol
- name: Installing NTP related packages.
yum:
name: nethserver-ntp
state: present
- name: Checking for NTP Configuration
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
become: yes
register: chk_ntp
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
ignore_errors: true
- name: Configuring NTP
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
become: yes
when: chk_ntp|changed
- name: Activating NTP
shell: /sbin/e-smith/signal-event nethserver-ntp-update
become: yes
when: chk_ntp|changed

View File

@ -0,0 +1,14 @@
---
# Installation and configuration of small services
- name: Installing other small services
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-cups
- nethserver-collectd
- nethserver-collectd-web
- nethserver-firewall-base
- nethserver-backup-config
- nethserver-backup-data

View File

@ -0,0 +1,78 @@
---
# Proxy and webfiltering configurations
- name: Installing proxy-related packages
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-squid
- nethserver-squidclamav
- nethserver-squidguard
# Squid
- name: Checking squid configuration
shell: /sbin/e-smith/db configuration printprop squid GreenMode
ignore_errors: yes
register: chk_squid
changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout"
- name: Configuring Squid
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000
when: chk_squid|changed
- name: Activating Squid configuration
shell: /sbin/e-smith/signal-event nethserver-squid-update
when: chk_squid|changed
# Squid-clamav
- name: Checking squidclamav configuration
shell: /sbin/e-smith/db configuration printprop squidclamav status
ignore_errors: true
register: chk_squidclamav
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
- name: Configuring squidclamav
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
when: chk_squidclamav|changed
- name: Activating squidclamav
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
when: chk_squidclamav|changed
# SquidGuard
- name: Verifying squidguard configuration
shell: /sbin/e-smith/db configuration printprop squidguard status
register: check_squidguard
changed_when: check_cf_enabled.stdout.find("disabled") != -1
- name: Configuring squidguard
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
when: chk_squidguard|changed
- name: Activating squidguard configuration
shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}"
with_items:
- save
- update
- downloadlists
when: chk_squidguard|changed
# Content filtering settings
- name: Verifying content filtering
shell: /sbin/e-smith/db contentfilter printprop default Categories
register: check_cf
changed_when: check_cf.stdout.find("porn") != -1
- name: Configuring content filtering
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
register: cf_cat
when: check_cf|changed
- name: Activating content filtering as a whole
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
when: check_cf|changed

View File

@ -1,24 +0,0 @@
- name: Configurazione scheda di rete esterna
shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp
when: development|bool
become: yes
- name: Configurazione scheda di rete interna
shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }}
when: development|bool
become: yes
- name: Attivo configurazioni di rete
shell: /sbin/e-smith/signal-event interface-update
when: development|bool
become: yes
- name: Configurazione rete trusted
shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }}
when: development|bool
become: yes
- name: Modifico configurazioni
shell: /sbin/e-smith/signal-event trusted-networks-modify
when: development|bool
become: yes

View File

@ -1,321 +0,0 @@
---
- name: Verifica configurazione organizzazione
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
register: check_org
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
ignore_errors: yes
become: yes
- name: Configurazione organizzazione
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
become: yes
when: check_org|changed
- name: Configurazione nome server
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
become: yes
register: chg_hostname
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
- name: Configurazione nome dominio
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
become: yes
register: chg_domainname
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
- name: Attivazione cambiamenti hostname
shell: /sbin/e-smith/signal-event hostname-modify
become: yes
when: chg_hostname|changed or chg_domainname|changed
- name: Verifica robustezza password
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
register: chk_passstr
changed_when: "'Users=none' not in chk_passstr.stdout"
become: yes
ignore_errors: true
- name: Configurazione forza password
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
become: yes
when: chk_passstr|changed
- name: Attivo configurazione policy password
shell: /sbin/e-smith/signal-event password-policy-update
become: yes
when: chk_passstr|changed
- name: Verifica configurazione DHCP
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
become: yes
ignore_errors: true
register: chk_dhcp
- name: Configurazione servizio DHCP
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
become: yes
when: chk_dhcp|failed
- name: Attivazione configurazione DHCP
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
become: yes
when: chk_dhcp|failed
- name: Verifica configurazione DNS
shell: /sbin/e-smith/db configuration printprop dns NameServers
become: yes
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout"
ignore_errors: yes
- name: Configurazione servizio DNS
shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}"
become: yes
when: chk_dns|changed
- name: Attivo configurazione DNS
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dns|changed
become: yes
- name: Verifica configurazione NTP
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
become: yes
register: chk_ntp
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
ignore_errors: true
- name: Configuro NTP
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
become: yes
when: chk_ntp|changed
- name: Attivazione NTP
shell: /sbin/e-smith/signal-event nethserver-ntp-update
become: yes
when: chk_ntp|changed
- name: Utilizzo unix extensions nei template per ibay
replace:
dest: /etc/e-smith/templates/etc/samba/smb.conf/10global
regexp: '^unix extensions = no$'
replace: 'unix extensions = yes'
become: yes
- name: Verifica configurazione SMB
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
become: yes
register: chk_smb
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
ignore_errors: true
- name: Configurazione SMB
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
become: yes
when: chk_smb|changed
- name: Attivo configurazione SMB
shell: /sbin/e-smith/signal-event nethserver-samba-save
become: yes
when: chk_smb|changed
- name: Abilito il ricaricamento dei servizi smb su ibay-create
file: src="reload" dest="{{ item }}/smb" state=link force=yes
with_items:
- /etc/e-smith/events/ibay-delete/services2adjust
- /etc/e-smith/events/ibay-create/services2adjust
- /etc/e-smith/events/ibay-modify/services2adjust
become: yes
- name: Verifica creazione share condiviso
shell: /sbin/e-smith/db accounts show shared
become: yes
ignore_errors: true
register: chk_shared
- name: Copying default templates for new template type
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring ibay-shared template structure (directory mask)
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'directory mask = 0775'
insertafter: '^create mask'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force create mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force create mode = 0664'
insertafter: '^directory mask'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force directory mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force directory mode = 0775'
insertafter: '^force create mode'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configurazione share Condiviso
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled
become: yes
when: chk_shared|failed
- name: Attivazione share condiviso
shell: /sbin/e-smith/signal-event ibay-create shared
become: yes
when: chk_shared|failed
- name: Changing ibay profile for shared
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Forcing regeneration of smb.conf
shell: /sbin/e-smith/signal-event nethserver-samba-update
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Verifica configurazione squid
shell: /sbin/e-smith/db configuration printprop squid GreenMode
become: yes
ignore_errors: yes
register: chk_squid
changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout"
- name: Configurazione squid
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000
become: yes
when: chk_squid|changed
- name: Attivazione configurazione squid
shell: /sbin/e-smith/signal-event nethserver-squid-update
become: yes
when: chk_squid|changed
- name: Verifying content filter activation
shell: /sbin/e-smith/db configuration printprop squidguard status
register: check_cf_enabled
changed_when: check_cf_enabled.stdout.find("disabled") != -1
become: yes
- name: Activating squidguard
shell: /sbin/e-smith/db configuration setprop squidguard status enabled
when: check_cf_enabled|changed
register: cf_enable
become: yes
- name: Verifying content filtering
shell: /sbin/e-smith/db contentfilter printprop default Categories
register: check_cf
changed_when: check_cf.stdout.find("porn") != -1
become: yes
- name: Configuring content filtering
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
become: yes
register: cf_cat
when: check_cf|changed
- name: Activating content filtering as a whole
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
when: cf_enable|changed or cf_cat|changed
become: yes
- name: Verifica configurazione squidguard
shell: /sbin/e-smith/db configuration printprop squidguard Lists
become: yes
ignore_errors: true
register: chk_squidguard
changed_when: "'Lists=shalla' not in chk_squidguard.stdout"
- name: Configurazione squidguard
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
become: yes
when: chk_squidguard|changed
- name: Activating squidguard configuration
shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}"
with_items:
- save
- update
- downloadlists
become: yes
when: chk_squidguard|changed
- name: Verifying content filter activation
shell: /sbin/e-smith/db configuration printprop squidguard status
register: check_cf_enabled
changed_when: "'disabled' not in check_cf_enabled.stdout"
become: yes
- name: Enabling squidguard for content filtering
shell: /sbin/e-smith/db configuration setprop squidguard status enabled
when: check_cf_enabled|changed
register: cf_enable
become: yes
- name: Verifying content filtering
shell: /sbin/e-smith/db contentfilter getprop default Categories
ignore_errors: yes
register: check_cf
changed_when: check_cf.rc != 0
become: yes
- name: Configuring content filtering
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
become: yes
register: cf_cat
when: check_cf|changed
- name: Activating content filtering as a whole
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
when: cf_enable|changed or cf_cat|changed
become: yes
- name: Verifica configurazione squidclamav
shell: /sbin/e-smith/db configuration printprop squidclamav status
become: yes
ignore_errors: true
register: chk_squidclamav
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
- name: Configurazione squidclamav
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
become: yes
when: chk_squidclamav|changed
- name: Attivazione squidclamav
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
become: yes
when: chk_squidclamav|changed
- name: Verifica completamento configurazione per certificato
shell: /sbin/e-smith/db configuration printprop pki CommonName
become: yes
ignore_errors: true
register: chk_crt
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
tags: regen-ca
- name: Completo la configurazione per produzione certificato
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
become: yes
tags: regen-ca
when: chk_crt|changed or force_regen_ca|bool
- name: Rigenero il certificato con le informazioni inserite
shell: /sbin/e-smith/signal-event certificate-update
become: yes
when: chk_crt|changed or force_regen_ca|bool
tags: regen-ca

View File

@ -0,0 +1,98 @@
---
# SAMBA and ibays
- name: Installing SAMBA and ibays packages
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-ibays
- nethserver-samba
- nethserver-samba-audit
# SAMBA
- name: Checking SMB configuration
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
register: chk_smb
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
ignore_errors: true
- name: "Enabling unix extensions on SAMBA"
replace:
dest: /etc/e-smith/templates/etc/samba/smb.conf/10global
regexp: '^unix extensions = no$'
replace: 'unix extensions = yes'
- name: Configuring SMB
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
when: chk_smb|changed
- name: Activating SMB
shell: /sbin/e-smith/signal-event nethserver-samba-save
when: chk_smb|changed
# ibays
- name: Enabling SMB services restart when managing ibays
file:
src: reload
dest: "{{ item }}/smb"
state: link
force: yes
with_items:
- /etc/e-smith/events/ibay-delete/services2adjust
- /etc/e-smith/events/ibay-create/services2adjust
- /etc/e-smith/events/ibay-modify/services2adjust
- name: Checking for shared ibay
shell: /sbin/e-smith/db accounts show shared
ignore_errors: true
register: chk_shared
- name: Copying default templates for shared template type
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring ibay-shared template structure (directory mask)
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'directory mask = 0775'
insertafter: '^create mask'
state: present
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force create mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force create mode = 0664'
insertafter: '^directory mask'
state: present
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force directory mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force directory mode = 0775'
insertafter: '^force create mode'
state: present
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring shared ibay
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled
when: chk_shared|failed
- name: Activating shared ibay
shell: /sbin/e-smith/signal-event ibay-create shared
become: yes
when: chk_shared|failed
- name: Changing ibay profile for shared
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Forcing regeneration of smb.conf
shell: /sbin/e-smith/signal-event nethserver-samba-update
become: yes
when: force_ibay_shared|bool or chk_shared|failed

View File

@ -1,17 +0,0 @@
---
neth_pkgs:
- nethserver-tftp
- nethserver-ibays
- nethserver-samba
- nethserver-samba-audit
- nethserver-cups
- nethserver-avahi
- nethserver-dnsmasq
- nethserver-collectd
- nethserver-collectd-web
- nethserver-squid
- nethserver-squidclamav
- nethserver-squidguard
- nethserver-firewall-base
- nethserver-backup-config
- nethserver-backup-data

View File

@ -1,3 +1,10 @@
---
# PXE services
- include: tftp.yml
become: yes
tags: tftp
# PXE configuration
- include: pxe.yml
become: yes
tags: pxe

View File

@ -1,104 +1,79 @@
---
# Configurazione dell'ambiente di boot via rete per i client
# Configuring other aspects for PXE
- name: Verifica configurazione tftp
shell: /sbin/e-smith/db configuration getprop dnsmasq dhcp-boot
register: chk_tftp_enabled
changed_when: "'pxelinux.0' not in chk_tftp_enabled.stdout"
ignore_errors: yes
become: yes
- name: Configuro tftp
shell: /sbin/e-smith/db configuration setprop dnsmasq tftp-status enabled dhcp-boot pxelinux.0
when: chk_tftp_enabled|changed
become: yes
- name: Attivo tftp
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_tftp_enabled|changed
become: yes
- name: Creo directory necessarie
file: path={{ item }} state=directory
- name: Creating mandatory directories
file:
path: "{{ item }}"
state: directory
with_items:
- /var/lib/tftpboot/pxelinux.cfg
- /var/lib/tftpboot/ubuntu/14.04/i386
- /var/lib/tftpboot/ubuntu/14.04/amd64
- /var/lib/tftpboot/utils/memtest86
become: yes
- name: pxelinux.0
get_url:
url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/pxelinux.0
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/pxelinux.0"
dest: /var/lib/tftpboot/pxelinux.0
become: yes
- name: pxelinux.cfg/default
template: src=pxelinux.cfg/default dest=/var/lib/tftpboot/pxelinux.cfg/default
become: yes
template:
src: pxelinux.cfg/default
dest: /var/lib/tftpboot/pxelinux.cfg/default
when: development is not defined or development|bool == false
- name: pxelinux.cfg/default - development
template:
src: pxelinux.cfg/default.dev
dest: /var/lib/tftpboot/pxelinux.cfg/default
become: yes
when: development is defined and development|bool
- name: bglug.png
copy: src=bglug.png dest=/var/lib/tftpboot/utils/bglug.png
become: yes
copy:
src: bglug.png
dest: /var/lib/tftpboot/utils/bglug.png
- name: vesamenu.c32
get_url:
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/boot-screens/vesamenu.c32"
dest: /var/lib/tftpboot/utils/vesamenu.c32
become: yes
- name: chain.c32
get_url:
url: "http://repo.bglug.it/pxelinux/chain.c32"
dest: /var/lib/tftpboot/utils/chain.c32
become: yes
- name: linux i386
get_url:
url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/linux
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/linux"
dest: /var/lib/tftpboot/ubuntu/14.04/i386/linux
become: yes
- name: initrd.gz i386
get_url:
url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/initrd.gz
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/initrd.gz"
dest: /var/lib/tftpboot/ubuntu/14.04/i386/initrd.gz
become: yes
- name: linux amd64
get_url:
url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/linux
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/linux"
dest: /var/lib/tftpboot/ubuntu/14.04/amd64/linux
become: yes
- name: initrd.gz amd64
get_url:
url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz
url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz"
dest: /var/lib/tftpboot/ubuntu/14.04/amd64/initrd.gz
become: yes
- name: memdisk
get_url:
url: "http://repo.bglug.it/pxelinux/memdisk"
dest: /var/lib/tftpboot/utils/memdisk
become: yes
- name: memtest86
get_url:
url: "http://repo.bglug.it/pxelinux/memtest86/vmlinuz"
dest: /var/lib/tftpboot/utils/memtest86/vmlinuz
become: yes
- name: hdt
get_url:
url: "http://repo.bglug.it/pxelinux/hdt.img"
dest: /var/lib/tftpboot/utils/hdt.img
become: yes

View File

@ -40,7 +40,7 @@
tags: upgrade
- name: Installo pacchetti addizionali
yum: name={{ item }} state=present
yum: name='{{ item }}' state=present
become: yes
with_items: addin_pkgs
with_items: '{{ addin_pkgs }}'
tags: pkg

21
roles/tftp.yml Normal file
View File

@ -0,0 +1,21 @@
---
# TFTP
- name: Installing TFTP
yum:
name: nethserver-tftp
state: present
- name: Checking TFTP configuration
shell: /sbin/e-smith/db configuration getprop dnsmasq dhcp-boot
register: chk_tftp_enabled
changed_when: "'pxelinux.0' not in chk_tftp_enabled.stdout"
ignore_errors: yes
- name: Configuring TFTP
shell: /sbin/e-smith/db configuration setprop dnsmasq tftp-status enabled dhcp-boot pxelinux.0
when: chk_tftp_enabled|changed
- name: Activating tftp
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_tftp_enabled|changed